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January 6, 2017 


VIA E-MAIL & U.S. 1 st CLASS MAIL 

Office of the Attorney General 
Attn: Security Breach Notification 
200 St. Paul Place 
Baltimore, MD 21202 
E-Mail: idtheft@oag.state.md.us 

Re: Notice of Data Security Incident 

Dear Sir or Madam: 

We represent Legal Aid Society of Orange County (“LASOC”), 2101 N. Tustin Avenue, Santa 
Ana, California 92705, and are writing to notify you of a data security incident that may affect the 
security of personal information of ten (10) Maryland residents. The investigation into this event 
is ongoing, and this notice will be supplemented with any new significant facts learned subsequent 
to its submission. By providing this notice, LASOC does not waive any rights or defenses 
regarding the applicability of Maryland law or personal jurisdiction. 

Nature of the Data Security Event 

LASOC developed the I-CAN! web application, which was previously used as part of the IRS’s 
Lree Lile Program by low-income individuals to prepare and file federal and state tax forms at no 
cost through an IRS website. On October 31, 2016, LASOC became aware that on or about 
September 25, 2016, copies of certain completed federal and state tax forms had become 
temporarily accessible to the general public through certain internet search engines. Specifically, 
tax forms from the 2007 and 2008 tax years that were filed through this program were found to be 
impacted. LASOC immediately took steps to investigate and mitigate the impact of this incident 
with the assistance of a third-party forensic investigation firm. 

LASOC’s investigation determined the types of personal information contained on impacted tax 
filings forms vary but may include any of the following information relating to both individual 
filers and/or other individuals with some relationship to the filer: name, Social Security number or 
individual taxpayer identification number, address, bank account information, date of birth, 
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medical or disability information, state or federal employer identification numbers, address, and 
signature. 

Regarding the impacted federal and state tax forms, LASOC is unaware of any actual or attempted 
misuse of the personal information contained within the forms. 

Notice to Maryland Residents 

LASOC mailed written notice regarding this incident to the ten (10) Maryland residents whose 
information was contained of one or more impacted state or federal tax forms on or about January 
6, 2016, in substantially the same form as the letter attached hereto as Exhibit A. 

Other Steps Taken and to Be Taken 

In addition to providing written notice of this incident to all affected individuals as described 
above, LASOC is offering all affected individuals access to 12 months of free credit monitoring 
and identity restoration services with Experian, and is providing these individuals with helpful 
information on how to protect against identity theft and fraud. LASOC is also providing written 
notice of this incident to other state regulators and consumer reporting agencies where required. 
LASOC has disabled the I-CAN! application and has also taken steps to direct the removal of 
impacted tax forms from search results on certain internet search engines. In addition, LASOC 
has contacted the IRS and Free File Alliance, and other appropriate governmental agencies, as 
required by applicable law. 


Contact Information 

Should you have any questions regarding this notification or other aspects of the data security 
event, please contact us at (267) 930-4774. 


Very truly yours, 



Jennifer A. Coughlin of 
MUFFEN COUGHFIN EEC 
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January 6, 2017 


Re: Notice of Data Breach 

Dear Sample A Sample: 


Legal Aid Society of Orange County (“LASOC”) is writing to inform you of a recent incident that may 
affect the security of your personal information. LASOC is providing this notice to ensure that you are 
aware of the incident so that you may take steps to protect your personal information should you feel it is 
appropriate to do so. 

What Happened? LASOC developed the I-CAN! web application, which was previously used by 
individuals, as part of the IRS’s Free File Program, to prepare and file tax forms at no cost to the filer. On 
October 31, 2016, LASOC became aware that certain completed tax forms from the 2007 and 2008 tax 
years had become temporarily accessible to the general public through a directed search on certain internet 
search engines. However, LASOC is unaware of any attempted or actual misuse of personal data contained 
within the tax forms that were temporarily accessible on the internet as a result of this incident. 

What Information Was Involved? As part of the investigation into this incident, LASOC determined a tax 
form containing the following information about you, as provided by the filer, was temporarily accessible to 
the general public through a directed search on certain internet search engines: name and Social Security 
number. 

What We Are Doing. LASOC takes the security of your personal information very seriously. Upon learning 
of this incident, LASOC immediately took steps to investigate and mitigate the impact of this incident, with 
the assistance of a third-party forensic investigation firm. LASOC has disabled the I-CAN! application. 
LASOC has also taken steps to direct the removal of the tax forms from search results on certain internet 
search engines. In addition, we have contacted the IRS as well as other appropriate governmental agencies. In 
addition to the steps taken above, and although LASOC is unaware of any actual or attempted misuse of your 
information, LASOC is providing notice of this incident to you, along with information on how to better 
protect against identity theft and fraud. LASOC is also offering you access to 12 months of free credit 
monitoring and identity restoration services with Experian ProtectMyID. Instructions on how to enroll and 
receive these services are included in the attached Privacy Safeguards. 

What You Can Do. LASOC encourages you to enroll and receive the complimentary access to credit 
monitoring and identity restoration services with Experian. LASOC also encourages you to take the steps 
described in the enclosed Privacy Safeguards to better protect yourself against identity theft and fraud. 
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For More Information. LASOC recognizes that you may have questions that are not answered in this 
letter. LASOC has established a confidential, toll-free hotline to assist you with questions regarding the 
incident. The hotline can be reached at (877) 238-3229, Monday through Friday from 9:00 a.m. to 7:00 
p.m. EDT, excluding major U.S. holidays. Please provide reference number 2793121416 when calling. 

LASOC sincerely apologizes for the inconvenience and concern this incident may cause, and remains 
committed to safeguarding the personal information in its care. 


Sincerely, 



/ 


Robert Cohen 

Executive Director, Legal Aid Society of Orange County 


Enclosure 


PRIVACY SAFEGUARDS 

To help detect the possible misuse of your information, LASOC is offering you 12 months of credit 
monitoring and identity restoration services with Experian at no cost to you. 

If you believe there was fraudulent use of your infonnation as a result of this incident and would like to 
discuss how you may be able to resolve those issues, please reach out to an Experian agent. If, after 
discussing your situation with an agent, it is determined that fraud resolution support is needed then an 
Experian Fraud Resolution agent is available to work with you to investigate and resolve each incident of 
fraud that occurred from the date of the incident (including, as appropriate, helping you with contacting 
credit grantors to dispute charges and close accounts; assisting you in placing a freeze on your credit file 
with the three major credit bureaus; and assisting you with contacting government agencies to help restore 
your identity to its proper condition.) 

Please note that this offer is available to you for one year from the date of this letter and does not require 
any action on your part at this time. 

The Terms and Conditions for this offer are located at www.experian.com/fraudresolution. You will also 
find self-help tips and information about identity protection at this site. 

While Fraud Resolution assistance is immediately available to you, we also encourage you to activate the 
fraud detection tools available through ProtectMylD B Alert as a complimentary one-year membership. This 
product provides you with superior identity detection and resolution of identity theft. To start monitoring 
your personal information please follow the steps below: 

Ensure that you enroll by: December 20, 2017 (Your code will not work after this date.) 
Visit the ProtectMylD website to enroll: www.protectmyid.com/alert 
Provide your activation code: XXXXXXXXXX 

If you have questions about the incident, need assistance with fraud resolution that arose as a result of this 
incident or would like an alternative to enrolling in ProtectMylD online, please contact Experian’s customer 
care team at (877) 297-7780 by December 20, 2017. Be prepared to provide engagement number 
PC105392 as proof of eligibility for the fraud resolution services by Experian. 

ADDITIONAL DETAILS REGARDING YOUR 12-MONTH PROTECTMYID MEMBERSHIP: 

A credit card is not required for enrollment in ProtectMylD. 

You can contact Experian immediately regarding any fraud issues, and have access to the following 
features once you enroll in ProtectMylD: 

■ Experian credit report at signup: See what information is associated with your credit file. 

■ Active Surveillance Alerts: Monitors Experian file for indicators of fraud. 

■ Fraud Resolution: Identity Theft Resolution agents are immediately available to help you 
address credit and non-credit related fraud. 

■ ExtendCARE: You receive the same high-level of Fraud Resolution support even after your 
ProtectMylD membership has expired. 
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$1 Million Identity Theft Insurance 1 : Provides coverage for certain costs and unauthorized 
electronic fund transfers. 


What you can do to protect your information: There are additional actions you can consider taking to 
reduce the chances of identity theft or fraud on your account(s). Please refer to 
www.experian.com/fraudresolution for this information. 

You may take action directly to further protect against possible identity theft or financial loss. LASOC 
encourages you to remain vigilant against incidents of identity theft and fraud, to review your account 
statements, and to monitor your credit reports and explanation of benefits forms for suspicious activity. 
Under U.S. law you are entitled to one free credit report annually from each of the three major credit 
reporting bureaus. To order your free credit report, visit www.annualcreditreport.com or call, toll-free, 1- 
877-322-8228. You may also contact the three major credit bureaus directly to request a free copy of your 
credit report. 

At no charge, you can also have these credit bureaus place a “fraud alert” on your file that alerts creditors 
to take additional steps to verify your identity prior to granting credit in your name. Note, however, that 
because it tells creditors to follow certain procedures to protect you, it may also delay your ability to obtain 
credit while the agency verifies your identity. As soon as one credit bureau confirms your fraud alert, the 
others are notified to place fraud alerts on your file. Should you wish to place a fraud alert, or should you 
have any questions regarding your credit report, please contact any one of the agencies listed below. 


Equifax 

P.O. Box 105069 
Atlanta, GA 30348 
800-525-6285 
www.equifax.com 


Experian 
P.O. Box 2002 
Allen, TX 75013 
888-397-3742 
www.experian.com 


TransUnion 
P.O. Box 2000 
Chester, PA 19016 
800-680-7289 
www.transunion.com 


You may also place a security freeze on your credit reports. A security freeze prohibits a credit bureau 
from releasing any information from a consumer’s credit report without the consumer’s written 
authorization. However, please be advised that placing a security freeze on your credit report may delay, 
interfere with, or prevent the timely approval of any requests you make for new loans, credit mortgages, 
employment, housing, or other services. If you have been a victim of identity theft, and you provide the 
credit bureau with a valid police report, it cannot charge you to place, list or remove a security freeze. In 
all other cases, a credit bureau may charge you a fee to place, temporarily lift, or permanently remove a 
security freeze. You will need to place a security freeze separately with each of the three major credit 
bureaus listed above if you wish to place a freeze on all of your credit files. 


To find out more on how to place a security freeze, you can use the following contact information: 


Equifax Security Freeze 
P.O. Box 105788 
Atlanta, GA 30348 
1-800-685-1111 

https://www.freeze.equifax.com 


Experian Security Freeze 
P.O. Box 9554 
Allen, TX 75013 
1-888-397-3742 
www.experian.com/freeze/ 

center.html 


TransUnion 
P.O. Box 2000 
Chester, PA 19016 
1-888-909-8872 
www.transunion.com/ 

securityfreeze 


1 Identity theft insurance is underwritten by insurance company subsidiaries or affiliates of American International Group, Inc. 
(AIG). The description herein is a summary and intended for infonnational purposes only and does not include all terms, 
conditions and exclusions of the policies described. Please refer to the actual policies for terns, conditions, and exclusions of 
coverage. Coverage may not be available in all jurisdictions. 
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You can further educate yourself regarding identity theft, and the steps you can take to protect yourself, by 
contacting your state Attorney General or the Federal Trade Commission. The Federal Trade Co mm ission 
also encourages those who discover that their information has been misused to fde a complaint with them. 
The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue, NW, Washington, DC 20580, 
www.ftc.gov/idtheft , 1-877-ID-TFIEFT (1-877-438-4338); TTY: 1-866-653-4261. Instances of known or 
suspected identity theft should be reported to law enforcement, your Attorney General, and the FTC. You 
can also further educate yourself about placing a fraud alert or security freeze on your credit file by 
contacting the FTC or your state’s Attorney General. For Maryland residents, the Attorney General can 
be reached at: 200 St. Paul Place, 16th Floor, Baltimore, MD 21202; 1-888-743-0023; and 
www.oag.state.md.us. For North Carolina residents, the Attorney General can be contacted by mail at 
9001 Mail Service Center, Raleigh, NC 27699-9001; toll-free at 1-877-566-7226; by phone at 1-919-716- 
6400; and online at www.ncdoj.gov. For Rhode Island residents, the Attorney General can be contacted 
by mail at 150 South Main Street, Providence, RI 02903; by phone at (401) 274-4400; and online at 
www.riag.ri.gov. A total of one (1) Rhode Island resident may be impacted by this incident. Customers 
have the right to file a police report if they ever experience identity theft or fraud. Please note that in order 
to file a crime report or incident report with law enforcement for identity theft, customers will likely need 
to provide some kind of proof that they have been a victim. This notice has not been delayed as a result of 
a law enforcement investigation. 





